Quarterly report: Incident Response trends in Summer 2020
Summary: Cisco Talos reported that Ryuk ransomware dominated incident response for the fourth consecutive quarter, shifting from commodity trojans to living-off-the-land tools, with email remaining the top infection vector alongside increased compromises of RDS, Citrix devices and Pulse VPN. In one engagement, a government organization had nearly 2,000 systems encrypted after adversaries recovered a domain administrator password stored in a Group Policy, used bcdedit, vssadmin and shadow copy deletion to block recovery, and used BitsAdmin, WMIC and PsExec to spread Ryuk to additional hosts.
Bottom line: A single stolen domain administrator password, recovered from a Group Policy, was enough to encrypt nearly 2,000 systems and critical services at a government organization - and the attackers used the victim's own built-in tools to do it.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026